Prefer exposing EKS secrets as mounted files rather than environment variables

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

AWS EKS clusters should deliver secrets to workloads as mounted files rather than environment variables, because environment variable values can unintentionally appear in logs while volume-mounted secrets are instantiated as tmpfs volumes and removed from the node when the Pod is deleted. This rule verifies that the AWS Secrets Store CSI Driver addon is installed on the cluster, which enables the AWS-recommended file-based secret delivery pattern through the AWS Secrets and Configuration Provider; per-workload inspection of env[].valueFrom.secretKeyRef and envFrom[].secretRef references is not available from cluster-level resources.

Remediation

Install the Secrets Store CSI Driver together with the AWS Secrets and Configuration Provider, then update workloads to read secrets from mounted file paths instead of environment variables. See Use AWS Secrets Manager secrets in Amazon EKS.

References